CJEU - C-798/24 - Jautiva

Summary

The Court of Justice of the European Union (CJEU) has ruled that Articles 5 and 6 of the GDPR prevent national legislation from making the personal data of minority shareholders publicly accessible. The court found that such broad disclosure is not required by Directive 2017/1132 and is disproportionate, violating data minimization and purpose limitation principles under GDPR. The ruling emphasizes that less intrusive measures, like demonstrating a legitimate interest, should be required for accessing such data.

Full text

Help CJEU - C-798/24 - Jautiva: Difference between revisions From GDPRhub Jump to:navigation, search VisualWikitext Revision as of 08:11, 8 September 2026 view sourceBms (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators298 edits Tag: Decisions [1.0] Latest revision as of 08:15, 8 September 2026 view source Bms (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators298 editsTag: Visual edit Line 90: Line 90: }}}} The CJEU held that Articles 5 and 6 GDPR preclude national legislation making minority shareholders’ personal data publicly accessible.The CJEU held that [[Article 5 GDPR|Articles 5]] and [[Article 6 GDPR|6 GDPR]] preclude national legislation making minority shareholders’ personal data publicly accessible. ==English Summary====English Summary== Line 101: Line 101: The data subjects argued that such disclosure constituted an unjustified and disproportionate interference with their rights, particularly because they were neither beneficial owners nor members of the company’s management bodies and did not exercise control over the company. The national legislation pursued several objectives, including ensuring transparency and protecting third parties, combating money laundering and terrorist financing, and facilitating the implementation of sanctions.The data subjects argued that such disclosure constituted an unjustified and disproportionate interference with their rights, particularly because they were neither beneficial owners nor members of the company’s management bodies and did not exercise control over the company. The national legislation pursued several objectives, including ensuring transparency and protecting third parties, combating money laundering and terrorist financing, and facilitating the implementation of sanctions. The Court was asked, in particular, whether Directive 2017/1132 required such disclosure and whether Articles 5 and 6 GDPR permitted national legislation providing unrestricted public access to that personal data.The Court was asked, in particular, whether Directive 2017/1132 required such disclosure and whether [[Article 5 GDPR|Articles 5]] and [[Article 6 GDPR|6 GDPR]] permitted national legislation providing unrestricted public access to that personal data. === Holding ====== Holding === The Court first held that Article 14(d) Directive 2017/1132 does not require the disclosure of information relating to all shareholders, including minority shareholders. Shareholders do not, merely by holding shares, participate in the administration, supervision or control of a company within the meaning of that provision. In particular, minority shareholders are generally not authorised to represent or bind the company or perform management or supervisory functions.The Court first held that Article 14(d) Directive 2017/1132 does not require the disclosure of information relating to all shareholders, including minority shareholders. Shareholders do not, merely by holding shares, participate in the administration, supervision or control of a company within the meaning of that provision. In particular, minority shareholders are generally not authorised to represent or bind the company or perform management or supervisory functions. Regarding the GDPR, the Court recalled that any processing must comply with the principles under [[Article 5 GDPR|Article 5 GDPR]] and satisfy one of the lawful bases under [[Article 6 GDPR|Article 6 GDPR]]. Since the disclosure was required by national law, the processing had to be assessed under [[Article 6 GDPR|Article 6(1)(c) GDPR]]. Pursuant to [[Article 6 GDPR|Article 6(3) GDPR]], the legal basis must pursue an objective of public interest and be proportionate to the legitimate aim pursued.Regarding the GDPR, the Court recalled that any processing must comply with the principles under [[Article 5 GDPR]] and satisfy one of the lawful bases under [[Article 6 GDPR]]. Since the disclosure was required by national law, the processing had to be assessed under [[Article 6 GDPR|Article 6(1)(c) GDPR]]. Pursuant to [[Article 6 GDPR|Article 6(3) GDPR]], the legal basis must pursue an objective of public interest and be proportionate to the legitimate aim pursued. The Court also referred to the principles of purpose limitation under [[Article 5 GDPR|Article 5(1)(b) GDPR]] and data minimisation under [[Article 5 GDPR|Article 5(1)(c) GDPR]]. The national court must therefore establish whether the purposes of the processing are sufficiently determined by law and whether the disclosure is necessary and proportionate to those purposes.The Court also referred to the principles of purpose limitation under [[Article 5 GDPR|Article 5(1)(b) GDPR]] and data minimisation under [[Article 5 GDPR|Article 5(1)(c) GDPR]]. The national court must therefore establish whether the purposes of the processing are sufficiently determined by law and whether the disclosure is necessary and proportionate to those purposes. Line 120: Line 117: Similarly, although transparency could facilitate the implementation of sanctions, unrestricted disclosure was not necessary. Less intrusive measures could include limiting disclosure to persons subject to sanctions or allowing access to other shareholders’ information only where a legitimate interest is demonstrated.Similarly, although transparency could facilitate the implementation of sanctions, unrestricted disclosure was not necessary. Less intrusive measures could include limiting disclosure to persons subject to sanctions or allowing access to other shareholders’ information only where a legitimate interest is demonstrated. Finally, the legislation lacked sufficient safeguards against abuse because the data were available online and could be downloaded in bulk by unidentified users. Consequently, the Court held that Articles 5 and 6 GDPR, read in light of Articles 7 and 8 CFR, preclude national legislation requiring the personal data of all shareholders, including minority shareholders, to be publicly accessible without conditions such as demonstrating a legitimate interest.Finally, the legislation lacked sufficient safeguards against abuse because the data were available online and could be downloaded in bulk by unidentified users. Consequently, the Court held that [[Article 5 GDPR|Articles 5]] and [[Article 6 GDPR|6 GDPR]], read in light of [https://fra.europa.eu/en/eu-charter/charter/title/title-ii-freedoms Articles 7] and [https://fra.europa.eu/en/eu-charter/charter/title/title-ii-freedoms 8 CFR], preclude national legislation requiring the personal data of all shareholders, including minority shareholders, to be publicly accessible without conditions such as demonstrating a legitimate interest. == Comment ==== Comment == Latest revision as of 08:15, 8 September 2026 CJEU - C-798/24 Jautiva Court: CJEU Jurisdiction: European Union Relevant Law: Article 5(1)(a) GDPR Article 5(1)(b) GDPR Article 5(1)(c) GDPR Article 6(1)(c) GDPR Article 6(3) GDPR Article 7 CFRArticle 8 CFRArticle 14(d) Directive 2017/1132 Decided: 03.09.2026 Parties: Latvijas Republikas Saeima Case Number/Name: C-798/24 Jautiva European Case Law Identifier: ECLI:EU:C:2026:679 Reference from: Latvijas Republikas Saeima Language: 24 EU Languages Original Source: AG OpinionJudgement Initial Contributor: bms The CJEU held that Articles 5 and 6 GDPR preclude national legislation making minority shareholders’ personal data publicly accessible. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources English Summary Facts Seventeen natural persons, who were minority shareholders of a public limited liability company, brought proceedings before the Satversmes tiesa (the Constitutional Court of Latvia). They challenged national legislation requiring information on shareholders to be included in the public companies register. The information made publicly available included shareholders’ identity and contact details, as well as

Entities